What this page is for
Use this page as the trust-policy hub for the UAIX launch surface. It connects the dedicated public pages for privacy and data, accessibility, and analytics to the current licensing and security release posture so reviewers can audit the whole trust layer from one governance section.
当前 policy map
- Privacy and Data for the public-reading, discovery, and data-exposure posture.
- Accessibility for readable-launch expectations, keyboard and mobile QA, and accessibility-significant release handling.
- Analytics for the current published limits on measurement, telemetry-significant changes, and disclosure posture.
- Governance, the 变更日志, and News for the authority model, dated release trail, and public narrative around trust-significant changes.
当前 licensing posture
- Active public launch theme: the current UAIX Authority theme declares
GPL v2 or laterin its public package header. - Other packaged artifacts: evaluate each distributed package against its own shipped header, notice, or bundled source terms rather than assuming one broader site-wide code license where none has yet been published.
- Public standards pages: treat the canonical page paths as the public reading, citation, and review surface for UAI-1 and related records. Do not infer a broader trademark, certification, or endorsement right from public availability alone.
Security and release discipline
- The public site is a standards and publication surface, not a live security gateway or managed trust service.
- 上线检查 should keep HTTPS, security headers,
.well-knowndelivery, sitemap delivery, validator behavior, and machine-facing route inventory aligned before public support claims are widened. - Use API 参考, 一致性包, the 验证器, and Implementations when a release needs reviewable machine evidence instead of prose-only assurance.
Observable response hardening
Use the section below when a launch reviewer needs the concrete response-header layer that now backs the public trust posture on WordPress-rendered routes, plus the boundary between app-level hardening and host-level deployment work.
X-Content-Type-Options
nosniff
防止公开标准页面和机器可读路由发生内容类型嗅探。
应用于： 公开 HTML、JSON、XML 以及类似的 WordPress 渲染响应。
Referrer-Policy
strict-origin-when-cross-origin
在保留同源调试上下文的同时，进一步收窄跨源 referrer 泄露。
应用于： 可能产生外部请求的公开文档和 API 响应。
Permissions-Policy
accelerometer=(), browsing-topics=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
明确声明启动表面不依赖特权浏览器能力，也不依赖基于 Topics 的广告功能。
应用于： 公开 WordPress 渲染页面与面向机器的路由。
X-Frame-Options
SAMEORIGIN
在保留同源编辑与预览流程的同时，阻止第三方框架嵌入。
应用于： 公开 WordPress 渲染页面与 JSON 响应。
Content-Security-Policy
frame-ancestors 'self'
在现代浏览器中明确框架边界，而不提前声称已经具备更广泛的全站 CSP。
应用于： 公开 WordPress 渲染页面与面向机器的路由。
Strict-传输-Security
max-age=31536000; includeSubDomains
把浏览器后续访问固定到规范上线主机的 HTTPS，而不只依赖政策文案。
应用于： 请求通过 HTTPS 提供时的公开 WordPress 渲染 HTML 和 REST 响应。
当前已生效
当前可在 WordPress 响应上观察到
- X-Pingback 已从公开响应中移除。
- 如果启动环境在 WordPress 执行后仍附加主机级或代理级版本头，这些头仍需要在服务器侧抑制。
- 这些响应头现在会随公开 WordPress 渲染的 HTML 与 REST 响应一同交付，而不再只是路线图文案中的计划。
部署缺口
仍属于主机或边缘层
- HTTP 到 HTTPS 重定向以及直接提供的静态文件的 HSTS 覆盖仍属于上线主机或 CDN 边缘层，因为本地 Studio 环境使用普通 HTTP。
- 任何直接提供的静态根文件都应在服务器或边缘层检查，以确保其响应头与 WordPress 渲染的信任姿态保持一致。
- 凡是部署栈在 WordPress 之外附加的主机级版本暴露，例如代理或 PHP 签名头，都应在相应层面被抑制。
- 更广泛的 CSP 指令应在面向生产的资源与嵌入行为相对于启动主机验证通过之后再添加。
范围边界： 当前响应头层适用于公开的 WordPress 前端和 REST 响应，包括验证器和面向机器的评审路由；HSTS 只在 HTTPS 请求上发送。
How these policy pages fit together
- Use this page as the hub: start here when the question is “which published policy surface should I read next?”
- Use the dedicated pages for the actual posture: Privacy and Data, Accessibility, and Analytics each publish the current launch-stage boundary for that area.
- Use 引用 and Contributors and
/.well-known/uaix.jsonwhen a reviewer needs the current public discovery and handoff packet without relying on screenshots or private instructions.
Principles-based policy review
- Cognitive-agency review: changes that affect lawful inquiry, viewpoint handling, behavioral conditioning, ranking, profiling, consent, telemetry, or automated authority require principles impact assessment.
- Memory promotion review: external source material, generated summaries, old chats, and dropped files stay quarantined until source, checksum, review state, redaction decision, promotion target, and rollback path are recorded.
- Support-claim review: certification, endorsement, legal-standing, SDK, CLI, runtime-control, hosted-import, automatic-sync, security-operations, consent-center, and policy-office language must remain future or research-track unless explicit public evidence exists.
- Public-record review: when trust posture changes, update the canonical page, machine artifact, tests, release trail, roadmap state, and local
.uaimemory together.
What is still future work
- A broader consent center, account-intake policy stack, or institutional legal program beyond what the site explicitly publishes today.
- A published certification authority, public security operations center, or claims of universal runtime assurance beyond the named 实施轨道 and release evidence.
- A broader multi-stakeholder governance body, contact center, or policy office unless and until those are formally published on canonical UAIX pages.
下一步 step
Continue to Privacy and Data, Accessibility, or Analytics for the detailed public posture in each area, then use 变更日志 and News when a trust-significant change needs dated release context.